RegEx Cheat Sheet

By Bogdan Sandu · Updated August 2, 2026

Most developers have copy-pasted a regex pattern at least once without fully understanding what it does. That works, until it doesn't.

Regular expressions are one of those tools that seem cryptic at first but make a lot of sense once the syntax clicks. Pattern matching, input validation, string manipulation, find and replace across files - regex handles all of it.

This regex cheat sheet covers the core syntax you actually need: character classes, quantifiers, anchors, capture groups, lookaheads, and common patterns across Python, JavaScript, and other languages.

Bookmark it. You'll come back to it.

What is RegEx

A regular expression (RegEx) is a sequence of characters that defines a search pattern used to match, find, or manipulate text.

It works across almost every programming language: Python, JavaScript, PHP, Java, Ruby, and more.

Not a formatting tool. Not a beautifier. A precision instrument for string manipulation, input validation, text parsing, and pattern matching.

---

RegEx Syntax

RegEx syntax is built from a small set of rules. Learn these, and every pattern starts to make sense.

Special Characters

These characters have reserved meaning in any regular expression engine:

Character	Meaning
.	Matches any single character except newline
^	Start of string (or line in multiline mode)
$	End of string (or line in multiline mode)
*	Zero or more repetitions
+	One or more repetitions
?	Zero or one repetition (also makes quantifiers lazy)
\	Escape character
`	`
()	Capturing group
[]	Character class
{}	Quantifier range

Literal Characters

Any character not listed above matches itself literally.

cat matches the exact string "cat" - case-sensitive by default.

Escape Sequences

Use \ before a special character to match it literally.

Sequence	Matches
\.	A literal dot
\*	A literal asterisk
\(	A literal opening parenthesis
\\	A literal backslash
\n	Newline
\t	Tab
\r	Carriage return

---

RegEx Character Classes

Character classes let you match any one character from a defined set.

Predefined Character Classes

Class	Description	Matches
\d	Digit	0-9
\D	Non-digit	Anything except 0-9
\w	Word character	a-z, A-Z, 0-9, _
\W	Non-word character	Anything \w won't match
\s	Whitespace	Space, tab, newline
\S	Non-whitespace	Anything \s won't match
.	Any character	Except newline (by default)

Custom Character Classes

Square brackets define a custom set. [aeiou] matches any single vowel.

Ranges work too: [a-z] matches any lowercase letter, [0-9] matches any digit, [a-zA-Z0-9] matches any alphanumeric character.

[aeiou]       → matches a, e, i, o, or u
[a-z]         → matches any lowercase letter
[A-Za-z0-9]   → matches any alphanumeric character
[.,!?]        → matches any of these punctuation marks

Negated Character Classes

Add ^ inside brackets to match anything NOT in the set.

[^aeiou]    → matches any character that is NOT a vowel
[^0-9]      → matches any non-digit character
[^\s]       → matches any non-whitespace character

---

RegEx Quantifiers

Quantifiers control how many times a pattern repeats.

Greedy Quantifiers

Greedy quantifiers match as much as possible. They're the default behavior.

Quantifier	Meaning	Example
*	0 or more	a* matches "", "a", "aaa"
+	1 or more	a+ matches "a", "aaa" but not ""
?	0 or 1	colou?r matches "color" and "colour"
{n}	Exactly n times	\d{4} matches exactly 4 digits
{n,}	n or more times	\d{2,} matches 2 or more digits
{n,m}	Between n and m times	\d{2,4} matches 2, 3, or 4 digits

Lazy Quantifiers

Add ? after any greedy quantifier to make it lazy - matches as little as possible.

Quantifier	Meaning
*?	0 or more (lazy)
+?	1 or more (lazy)
??	0 or 1 (lazy)
{n,m}?	Between n and m (lazy)

Input: <b>bold</b>
Greedy:  <.+>   → matches <b>bold</b> (entire string)
Lazy:    <.+?>  → matches <b> (stops at first >)

Possessive Quantifiers

Supported in Java, PCRE, and a few other engines. Not available in JavaScript.

They match greedily and never give back characters, which can prevent backtracking.

Quantifier	Meaning
*+	0 or more (possessive)
++	1 or more (possessive)
?+	0 or 1 (possessive)

---

RegEx Anchors and Boundaries

Anchors don't match characters. They match positions in a string.

Start and End Anchors

Anchor	Matches
^	Start of string (or line with m flag)
$	End of string (or line with m flag)
\A	Start of string (ignores m flag)
\Z	End of string (ignores m flag)

^Hello        → matches "Hello" only at the start
world$        → matches "world" only at the end
^\d{3}-\d{4}$ → matches exactly "123-4567" and nothing else

Word Boundaries

Word boundaries match the position between a word character (\w) and a non-word character (\W).

Boundary	Matches
\b	Word boundary
\B	Non-word boundary

\bcat\b    → matches "cat" in "the cat sat" but NOT in "category"
\Bcat\B    → matches "cat" inside "concatenate" but NOT as a standalone word

Line vs String Anchors

By default, ^ and $ match the start and end of the entire string.

Enable multiline mode (m flag) and they match the start and end of each individual line instead.

Without m flag:   ^cat$  → only matches if the entire string is "cat"
With m flag:      ^cat$  → matches "cat" on any line within a multiline string

RegEx Groups and Capturing

Groups let you isolate, reuse, and reference parts of a matched pattern.

Capturing Groups

Wrap any pattern in () to capture it. The engine stores the match so you can reference it later.

(\d{4})-(\d{2})-(\d{2})
→ Matches "2024-01-15", captures year, month, day in groups 1, 2, 3

Non-Capturing Groups

(?:...) groups without storing the match. Use when you need grouping for structure but don't need the captured value.

(?:https?|ftp)://   → groups "https", "http", or "ftp" without capturing

Named Capturing Groups

Assign a name instead of a number. Cleaner to reference, especially in long patterns.

(?P<year>\d{4})-(?P<month>\d{2})    # Python
(?<year>\d{4})-(?<month>\d{2})      # JavaScript, .NET, Java

Access via match.group('year') in Python or match.groups.year in JavaScript.

Backreferences

Reference a previously captured group inside the same pattern using \1, \2, etc.

(\w+)\s\1       → matches repeated words like "the the" or "go go"

---

RegEx Lookahead and Lookbehind

Lookarounds check what surrounds a match without including that context in the result.

Zero-width assertions. They check position, not content.

Positive Lookahead

(?=...) matches if what follows fits the pattern.

\d+(?= dollars)   → matches "100" in "100 dollars" but not in "100 euros"

Negative Lookahead

(?!...) matches if what follows does NOT fit the pattern.

\d+(?! dollars)   → matches "100" in "100 euros" but skips "100 dollars"

Positive Lookbehind

(?<=...) matches if what precedes fits the pattern.

(?<=\$)\d+    → matches "99" in "$99" but not in "99 USD"

Negative Lookbehind

(?<!...) matches if what precedes does NOT fit the pattern.

(?<!\$)\d+    → matches "99" in "99 USD" but skips "$99"

Note: JavaScript (pre-ES2018) does not support lookbehind. Most other major engines do.

---

RegEx Flags and Modifiers

Flags change how the entire pattern behaves. Placed after the closing delimiter or passed as a second argument.

Flag	Name	Effect	Example
i	Case insensitive	a matches A and a	/cat/i matches "Cat", "CAT"
g	Global	Find all matches, not just the first	/\d+/g returns every number
m	Multiline	^ and $ match per line	/^\w+/gm matches first word per line
s	Dotall	. matches newlines too	/a.b/s matches "a\nb"
x	Extended	Allows whitespace and comments in patterns	Supported in Python, PHP, Ruby
u	Unicode	Enables full Unicode support	/\p{L}+/u matches Unicode letters

/hello/gi     → matches "hello", "Hello", "HELLO" anywhere in the string

---

RegEx Syntax by Language

The core syntax is consistent. Delimiters, flags, and a few edge cases vary by language.

RegEx in JavaScript

Uses RegExp object or literal /pattern/flags syntax. Lookbehind requires ES2018+.

const pattern = /^\d{4}-\d{2}-\d{2}$/;
pattern.test("2024-01-15");   // true

const matches = "one 1, two 2".match(/\d+/g);  // ["1", "2"]

Key methods: .test(), .match(), .replace(), .split(), .exec()

RegEx in Python

Uses the built-in re module. Supports named groups, lookbehind, and verbose mode (re.X).

import re

pattern = re.compile(r"(\d{4})-(\d{2})-(\d{2})")
match = pattern.search("Date: 2024-01-15")
print(match.group(1))  # "2024"

Key functions: re.search(), re.match(), re.findall(), re.sub(), re.compile()

RegEx in PHP

Uses PCRE via preg_* functions. Patterns wrapped in delimiters (usually /).

preg_match('/(\d{4})-(\d{2})/', '2024-01', $matches);
echo $matches[1]; // "2024"

preg_replace('/\s+/', '-', 'hello world'); // "hello-world"

Key functions: preg_match(), preg_match_all(), preg_replace(), preg_split()

RegEx in Java

Uses java.util.regex package. Patterns compiled from strings - backslashes need escaping (\\d not \d).

import java.util.regex.*;

Pattern p = Pattern.compile("(\\d{4})-(\\d{2})-(\\d{2})");
Matcher m = p.matcher("2024-01-15");
if (m.find()) {
    System.out.println(m.group(1)); // "2024"
}

Key classes: Pattern, Matcher

RegEx in Ruby

Uses the Regexp class or literal /pattern/ syntax. Named groups work cleanly with symbol access.

str = "2024-01-15"
match = str.match(/(?<year>\d{4})-(?<month>\d{2})/)
puts match[:year]   # "2024"

Key methods: .match(), .scan(), .gsub(), .split()

---

Common RegEx Patterns

Patterns you'll actually use. Copy, test, adjust for your input.

Use Case	Pattern	Notes
Email	^[\w.+-]+@[\w-]+\.[a-zA-Z]{2,}$	Basic validation; RFC 5322 is far more complex
URL	https?://[\w./-]+	Simplified - use a library for production
Phone (US)	\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}	Handles common US formats
IP Address (IPv4)	\b(?:\d{1,3}\.){3}\d{1,3}\b	Does not validate the 0–255 range
Date (YYYY-MM-DD)	\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])	Validates month and day ranges
HTML tag	<[^>]+>	Matches any tag - not for parsing full HTML
Whitespace (trim)	^\s+|\s+$	Matches leading and trailing whitespace
Password	^(?=.*[A-Z])(?=.*\d)(?=.*[\W_]).{8,}$	8+ chars, uppercase, digit, special char
Hex color	#[0-9a-fA-F]{3,6}	Matches 3 or 6 digit hex codes
Username	^[a-zA-Z0-9_]{3,16}$	3–16 alphanumeric characters or underscores

---

RegEx Operators and Alternation

Pipe Operator

| acts as a logical OR between two expressions.

cat|dog       → matches "cat" or "dog"
jpg|jpeg|png  → matches any of these file extensions

Precedence Rules

Alternation has the lowest precedence in a regular expression.

cat|dog food matches "cat" OR "dog food", not "cat food" OR "dog food". Wrap in a group to control scope: (cat|dog) food.

Grouping with Alternation

Combine alternation with groups to build clean branching patterns.

^(Mr|Mrs|Ms|Dr)\. [A-Z][a-z]+$
→ matches "Dr. Smith", "Ms. Jones"

---

How to Test RegEx

Online RegEx Testers

These tools give real-time match highlighting, group inspection, and engine selection.

• Regex101 - best overall; supports PCRE, JavaScript, Python, Go; explains each token inline

• Regexr - clean interface, good for beginners learning pattern matching

• Debuggex - renders a visual NFA/DFA diagram of your pattern

RegEx Debugging Tips

• Test against both matching and non-matching strings

• Break complex patterns into smaller pieces, then build up

• Use verbose mode (x flag) to add whitespace and inline comments

• Check for catastrophic backtracking before running on large inputs

• Regex101's step-through debugger shows exactly how the engine processes each character

---

RegEx Performance and Backtracking

Backtracking happens when the engine tries a path, fails, then backs up and retries.

Minor backtracking is normal. Catastrophic backtracking is a bug - it can freeze an application on specific inputs.

What Causes It

Nested quantifiers on overlapping patterns. (a+)+b on a string like "aaaaaa" with no b at the end triggers an exponential number of retries.

Other common causes:

• (.+)* or (.*)+ - redundant quantifier nesting

• Alternation with shared prefixes: (cat|catch) - use (cat(?:ch)?) instead

• Overly broad .+ patterns mid-string with nothing to anchor the match

How to Avoid It

• Use possessive quantifiers (*+, ++) in engines that support them - Java, PCRE

• Use atomic groups (?>...) in PCRE/Java to prevent backtracking into a completed group

• Prefer specific character classes over . wherever possible

• Test adversarial inputs on Regex101's debugger before shipping to a production environment

• During the code review process, flag any pattern with nested quantifiers for manual testing

FAQ on Regex

What is RegEx used for?

RegEx is used for pattern matching, input validation, text parsing, and string manipulation.

Common applications: validating email addresses, extracting URLs, finding duplicates, parsing log files, and running find-and-replace across large codebases.

What does .* mean in RegEx?

. matches any single character except a newline.

* is a greedy quantifier meaning zero or more repetitions. Together, .* matches any sequence of characters on a single line - as much as possible.

What is the difference between greedy and lazy quantifiers?

Greedy quantifiers match as much text as possible. Lazy quantifiers (add ?) match as little as possible.

<.+> grabs everything between the first < and the last >. <.+?> stops at the first > it finds.

What does ^ mean in a RegEx pattern?

Outside a character class, ^ is a start anchor - it matches the position at the beginning of a string.

Inside brackets like [^abc], it negates the set, matching any character that is NOT a, b, or c.

What are RegEx flags?

Flags modify how the regex engine processes a pattern.

Common ones: i (case-insensitive), g (global - find all matches), m (multiline - ^ and $ match per line), s (dotall - . matches newlines too).

What is a capturing group in RegEx?

Parentheses () create a capturing group, storing the matched text for later use via backreferences or in replacement strings.

Non-capturing groups (?:...) group without storing. Named groups (?<name>...) let you reference matches by name instead of index.

How do word boundaries work in RegEx?

\b matches the position between a word character (\w) and a non-word character (\W).

\bcat\b matches "cat" as a standalone word but skips "category" or "concatenate". Useful for precise string search without partial matches.

Does RegEx syntax differ between programming languages?

Yes. Core syntax is consistent, but engine-specific features vary.

JavaScript lacks lookbehind in older versions and has no possessive quantifiers. Python's re module supports named groups. PCRE (used in PHP) is the most feature-complete regex flavor available.

What is catastrophic backtracking in RegEx?

It happens when a pattern with nested quantifiers - like (a+)+ - tries an exponential number of combinations on a non-matching string.

The regex engine keeps retrying, causing serious performance slowdowns. Fix it by rewriting ambiguous patterns or using possessive quantifiers where supported.

How do I test a RegEx pattern?

Use an online regex tester like Regex101, Regexr, or Debuggex.

These tools show real-time match highlighting, break down each part of your pattern, and let you switch between regex flavors like PCRE, JavaScript, and Python.